{"id":"elastic-security-d982e2a72ba5","seq":2814,"kind":"advisory","title":"Kibana 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-187)","url":"https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860","permalink":"https://vulnpulse.app/items/elastic-security-d982e2a72ba5","summary":"Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, \"tenant\" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Bec…","severity":null,"techs":["elasticsearch"],"cves":[],"tags":["security"],"source":{"id":"elastic-security","name":"Elastic Security Announcements"},"published_at":"2026-10-06T18:36:48.000Z","fetched_at":"2026-10-21T16:17:47.217Z"}